cFocus Software seeks a Forensic and Malware Lead to join our program supporting the Administrative Office of the United States Courts (AOUSC). This position is onsite location being in Washington, DC. This position requires a Public Trust clearance. Qualifications: • Ability to obtain a Public Trust clearance • B.S. Computer Science, Information Technology, or a related field • Five (5) years within IR in a large SOC (over 5,000 endpoints) with at least 3 years focused on digital forensics for Operating System or file systems. • Three (3) years of demonstrated expertise in disk, memory and registry analysis using industry standard tools such as EnCase, FTK, X-Ways, Volatility. • Demonstrated understanding of file systems and Operating System artifacts including but not limited to (SRUM, Shellbags and Prefetch). • Familiarity with federal evidence guidelines and chain of custody requirements. • This role aligns with NICE work role PD-WRL-002 (Digital Forensics). • Active GCFA, GREM, CFCE, or OSED certification Duties: • Lead digital forensics and malware analysis activities in support of AOUSC Security Operations Division (SOD) operations. • Provide advanced subject matter expertise for forensic investigations involving Windows, Linux, macOS, cloud, and enterprise environments. • Perform static and dynamic malware analysis to identify indicators of compromise (IOCs), attacker tactics, techniques, and procedures (TTPs), and root cause. • Analyze forensic artifacts, memory images, endpoint telemetry, SIEM data, and filesystem timelines to identify malicious activity and intrusion vectors. • Coordinate with Cybersecurity Triage and Incident Response teams to support investigation, escalation, containment, remediation, and recovery activities. • Conduct live forensic analysis utilizing Splunk Enterprise Security, Microsoft Sentinel, EDR tools, and AO-provided investigative tooling. • Collect, preserve, duplicate, and maintain digital evidence in accordance with forensic evidence handling and chain-of-custody procedures. • Develop forensic reports, malware analysis reports, incident artifacts, and technical documentation in accordance with Judiciary SOC Forensics SOPs and JSOCIRP requirements. • Provide real-time investigative support for Priority 1 and Priority 2 cybersecurity incidents. • Support analysis of advanced persistent threats (APT), ransomware, phishing campaigns, malicious scripts, and suspicious binaries. • Perform memory analysis using approved forensic tools such as Volatility and other Judiciary-approved forensic platforms. • Extract deleted or hidden data using forensic data carving and recovery techniques. • Conduct analysis of endpoint, network, identity, and cloud telemetry to support incident investigations and threat hunting operations. • Coordinate escalation and communication of investigative findings to AO leadership, incident responders, SOC management, and federal staff. • Review and validate forensic and malware analysis deliverables to ensure technical accuracy, completeness, and compliance with SLA requirements. • Develop and maintain forensic analysis procedures, malware analysis SOPs, investigative work instructions, and operational playbooks. • Support enterprise security awareness reporting by contributing forensic findings, threat trends, and investigative recommendations. • Participate in weekly technical meetings, operational briefings, and cybersecurity reporting activities. • Support continuous process improvement initiatives related to digital forensics, malware analysis, investigative workflows, and incident response operations. • Assist in transition-in and transition-out activities including knowledge transfer, operational readiness, training, and documentation support.